Trade secrets obtained from personal data

Every entrepreneur is aware of how valuable business secrets can be. Its disclosure can lead to serious problems, especially when it also concerns the personal data of the entrepreneur’s customers. Incidents of company data leakage and breaches related to the processing of personal data crop up in the media from time to time, illustrating that this problem – despite the efforts of the legislator – is ever-present. At the same time, the loss or mere disclosure of customers’ personal data always poses serious problems for businesses: from loss of reputation, damage to image, loss of alienated customers, to making business impossible.

Not so long ago, there was a buzz in Poland about the entry into force of the so-called General Data Protection Regulation (RODO). These regulations became effective in Poland at the end of May 2018 and aim to strengthen the protection of individuals in relation to the processing of their personal data and the flow of such data. The RODO introduced a number of changes to the data protection rules, expanding the obligations of personal data processors.

While it is true that the issue with which the client approached for support arose in the pre-RODO period, even then the law provided for certain requirements for personal data processors and penalties for data violators, including criminal liability. Today – with the RODO – the protection is even stronger and the sanctions more severe.

In the case at hand, the client, a large telecommunications company, fell victim to its own subcontractors who processed the personal data of its customers (subscribers). It must be emphasised that inherent in the conduct of business activities by the telecommunications company in question was the collection and processing of a huge amount of personal data of its customers, which took place in compliance with the principles contained, inter alia, in the Personal Data Protection Act.

The business model adopted by the client assumed that not only the service of existing customers (subscribers), but also the acquisition of new ones, would be carried out in two ways: by the client’s own employees and by external companies – subcontractors – specialising in this type of activity (agents). The external companies in question took a variety of forms, ranging from limited liability companies to sole proprietorships. Importantly in the context of further criminal law action, the client has always remained scrupulous when it comes to compliance with data protection legislation.

It soon became apparent that subscribers began to approach the customer with complaints about the violation of personal data. As it was established, customers of the telecommunications company were approached by unidentified persons, who – knowing the exact parameters of the subscribers’ existing contracts – offered them much more favourable terms of service provided by a competing telecommunications company. This specific kind of ‘canvassing’ sometimes took a rather ruthless form: certain persons went directly to the subscribers’ homes, informed them that they knew their personal details and the form of the concluded contracts, as well as about the end of the contract or upcoming changes to the regulations, which made it possible to terminate the contracts without incurring contractual penalties. Then, in an insistent or even aggressive manner, they urged them to change their telecommunications service provider. The telecommunications company’s subscribers reported many of these violations to the customer – via the service desk – which was scrupulously recorded. A whole list of such violations was soon compiled.

By carrying out an internal investigation at the client, it was established that data breaches were occurring in well-defined areas that were linked to the activities of the company’s agents. It also soon became apparent that a large proportion of these agents had terminated their cooperation with the client and had started working with another telecommunications company. It so (un)fortunately happened that the client’s subscribers were persuaded to start working with the same telecoms company that the client’s existing agents had started working with.

It should be added that all the persons who at the client were in charge of, among other things, acquiring new customers or servicing their contracts, had access to a part of the IT system that contained the subscriber database. However, according to the Act, as well as the contractual obligations imposed on the agents, they were not entitled to process (use) this personal data and were even obliged not to use it in any business activity other than that of the client (with whom they had terminated their cooperation).

The client regularly logged an increasing number of calls from its dissatisfied subscribers, some of which it had in fact lost.

The telecoms company undoubtedly found itself in a crisis situation and the question had to be raised as to whether it could react quickly to the problem.

Naturally, it was possible to take legal action in the civil courts (which happened anyway), but this was not immediate protection. Consider that – contrary to media reports – there was no negligence at all on the part of the customer with regard to the protection of personal data. As I mentioned earlier, the opposite was true: the telecommunications company safeguarded the interests of its subscribers with, among other things, appropriate provisions in its contracts with agents. The totality of these circumstances made it possible to attempt to hold the perpetrators criminally liable.

Indeed, the criminal law has more offensive means of protection against the agents’ actions presented. There is an entire chapter in the Penal Code on offences against information protection, and the relevant criminal provisions were contained in the Personal Data Protection Act (this Act in its current wording also contains analogous norms). In view of the above, it was decided to notify law enforcement authorities of the possibility of committing offences (e.g. under Article 266 of the Penal Code or former Article 49 of the Personal Data Protection Act corresponding to the current Article 107 of the Act).

The initiation of preparatory proceedings conducted by the police under the supervision of the public prosecutor’s office quickly revealed further circumstances, new from the point of view of the client’s interests. Indeed, the law enforcement authorities, with the active support of the injured party (the client), revealed that the criminal procedure concerning the illegal use of personal data has a wider scope than previously expected.

Although the building in which this “centre” was located was not marked in any way, the employees had adapted workstations for making telephone calls and the “canvassers” there obtained lists with detailed subscriber data. Even the people working in this specific facility often did not know the source of this data, indicating that they received it from their superiors. As it also soon turned out, databases acquired from people such as agents were flowing into the ‘call centre’.

On the initiative of the victim in the pre-trial proceedings (the client), a search was conducted at the premises of this illegal ‘call centre’, IT data, hard drives, laptops and other data carriers were secured. Soon, a number of people heard charges that concerned not only the processing of personal data in an unauthorised manner and in violation of data protection regulations, but also charges involving the disclosure and use of information that the perpetrators were obliged not to use, as well as unlawful connection to the telecommunications network.

Such actions caused the ‘house of cards’ built by the perpetrators to crumble. There was panic among the agents, and the criminal activity was hastily terminated, even at the stage of preliminary proceedings. At the same time, some of the perpetrators who had been charged decided to agree on the conditions for incurring criminal liability with the prosecutor, at the same time providing explanations that were incriminating to the other accomplices. Of course, the news of such a turn of events quickly spread in the media, which not only improved the client’s image in the eyes of the public and exonerated it, but also made it clear that the telecommunications company had become a victim of criminals trading in personal data and that the perpetrators had already heard the charges. Such a message has also had a preventive effect: after all, it has sent a clear message that this type of practice will not be tolerated and the perpetrators will be consistently brought to justice. It is worth noting that the convictions of the perpetrators of the offences in question are now final.

The presented history illustrates how important it is to observe the principles of personal data protection, which not only secures the legal interests of data subjects and protects the entity processing the data from liability (including of a criminal nature), but also makes it possible to activate law enforcement authorities in order to hold potential perpetrators criminally liable.